EU Cyber Resilience Act (CRA)

The CRA (Regulation (EU) 2024/2847) applies to most hardware and software products with digital elements sold in the EU. Manufacturers must design for security (no known exploitable vulnerabilities at release, secure default settings, data protection, secure updates), handle vulnerabilities throughout a declared support period, which generally must be at least five years unless the product is expected to be used for less, and document all of it, including a software bill of materials, in the technical file for CE marking.

Key dates: obligations to report actively exploited vulnerabilities and severe incidents apply from 11 September 2026; most other obligations, including conformity assessment, apply from 11 December 2027. Some "important" and "critical" product categories need stricter conformity assessment.

Where it bites: it turns update infrastructure, vulnerability handling and SBOMs into legal requirements, which affects architecture decisions being made now for products that will still be on sale after 2027.